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IN  THE  UNITED  STATES  DISTRICT  COURT 
FOR  THE  DISTRICT  OF  COLUMBIA 


UNITED  STATES  OF  AMERICA, 
Plaintiff, 
v. 

FACEBOOK  INC., 

Defendant. 


Civ.  ActionNo.  l:19-cv-02184 


REPLY  OF  THE  ELECTRONIC  PRIVACY  INFORMATION  CENTER  TO 
RESPONSES  OF  UNITED  STATES  AND  FACEBOOK  TO  MOTION  TO  INTERVENE 

Neither  the  Government  nor  Facebook  oppose  EPIC’s  motion  to  participate  in  this  case 
as  amici,  or  EPIC’s  motion  that  the  Court  allow  other  interested  parties  the  opportunity  to 
participate  in  this  case.  The  Government  and  Facebook  also  do  not  contest  that  the  Court  must 
closely  scrutinize  the  proposed  settlement.  The  only  issues  in  dispute  are  (1)  whether  the  Court 
should  grant  EPIC’s  motion  to  join  as  an  intervenor  under  FRCP  24 1  and  (2)  whether  the  Court 
should  review  the  proposed  Stipulated  Order  (“FTC-Facebook  Consent  Decree”)  under  the 
fairness  and  public  interest  standard  established  by  the  D.C.  Circuit  in  Citizens  for  a  Better 
Environment  v.  Gorsuch,  718  F.2d  1117,  1 125-26  (D.C.  Cir.  1983),  see  also  In  re  Idaho 
Conservation  League,  811  F.3d  502,  515  (D.C.  Cir.  2016)  (citing  Citizens  for  a  Better 
Environment,  718  F.2d  at  1 125-26),  and  hold  a  hearing  on  that  issue. 

District  courts  have  “wide  latitude”  to  grant  intervention,  especially  permissive 
intervention  under  Rule  24(b).  In  re  Endangered  Species  Act  Sec.  4  Deadline  Litigation-MDL 

1  Neither  party  opposes  EPIC’s  alternative  request  to  participate  as  amicus.  The  Court  should  accordingly  grant  that 
relief  and  set  a  briefing  schedule  for  amicus  filings  if  it  denies  EPIC’s  motion  to  intervene. 
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No.  2165,  704  F.3d  972,  980  (D.C.  Cir.  2013)  (quoting  EEOC  v.  National  Children ’s  Ctr.,  Inc., 
146  F.3d  1042  (D.C.  Cir.  1998)).  The  Government  incorrectly  asserts  that  an  “independent 
ground  for  subject-matter  jurisdiction”  is  required.  United  States  Opp’n  12.  That  is  not  the  case, 
In  re  Endangered  Species  Act,  704  F.3d  at  980,  and,  even  if  it  were,  EPIC  does  have  Article  III 
standing  to  challenge  the  Federal  Trade  Commission’s  final  agency  action  closing  more  than 
26,000  open  complaints  (including  EPIC’s  complaints)  against  Facebook  in  an  arbitrary, 
capricious,  and  unlawful  manner.  5  U.S.C.  §  706(2)(A).  The  Commission’s  unprecedented 
decision  to  offer  the  largest  social  media  company  in  the  world  immunity  for  all  violations  of  the 
FTC  Act  and  the  prior  Consent  Order  committed  over  a  seven-year  period  raises  significant 
fairness  and  arbitrariness  concerns  that  justify  EPIC’s  intervention  and  the  Court’s  close 
scrutiny.  The  Court  should  accordingly  grant  EPIC’s  motion  for  leave,  set  a  briefing  schedule  for 
EPIC  and  other  interested  parties  to  address  the  fairness  and  adequacy  of  the  Consent  Decree, 
and  hold  a  hearing  to  address  those  issues. 

I.  The  Court  must  evaluate  the  fairness,  adequacy,  and  public  interest  of  the  proposed 
consent  decree,  and  a  hearing  with  full  participation  by  interested  parties  would 
facilitate  that  evaluation. 

The  Government  fails  in  its  opposition  to  address  the  requirement  that  courts  “assess 
whether  [a  proposed  consent  decree]  fairly  and  reasonably  resolves  the  controversy  in  a  manner 
consistent  with  the  public  interest.”  United  States  v.  District  of  Columbia,  933  F.  Supp.  42,  46 
(D.D.C.  1996)  (citing  Citizens  for  a  Better  Environment,  718  F.2d  at  1 126).  While  it  is  true  that  a 
court  does  not  “substitute  its  judgment  for  that  of  the  parties  to  the  decree,”  the  Court  must 
“assure  itself  that  the  terms  of  the  decree  are  fair  and  adequate  and  are  not  unlawful, 
unreasonable,  or  against  public  policy.”  Id.  (citation  omitted).  The  consent  decree  must  be  (1) 
“both  procedurally  and  substantively  fair;”  (2)  “adequate,  reasonable,  and  appropriate”  “from  an 
objective  point  of  view,”  focusing  “on  the  extent  to  which  the  decree  is  confined  to  the  dispute 
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between  the  parties  and  whether  the  decree  adequately  accomplishes  its  purported  goal;”  and  (3) 
“consistent  with  the  public  interest.”  Appalachian  Voices  v.  McCarthy,  38  F.  Supp.  3d  52,  55-57 
(D.D.C.  2014). 

EPIC  has  raised  concerns  about  the  fairness,  adequacy,  and  public  interest  in  the 
proposed  FTC-Facebook  Consent  Decree.  In  opposition,  the  Government  focuses  only  on  the 
public  interest  prong,  asserting  that  there  is  no  disagreement  about  the  public  interest  in  the 
proposed  consent  decree.  But  EPIC  does  disagree  that  the  proposed  consent  decree  is  in  the 
public  interest.  And  the  Government’s  reliance  on  United  States  v.  Western  Electric  Company, 
900  F.2d  283  (D.C.  Cir.  1990),  is  misplaced  because  they  have  quoted  the  decision  out  of 
context.  The  operative  test  in  the  D.C.  Circuit  for  a  court  reviewing  a  proposed  consent  decree  is 
the  fairness  and  public  interest  test  outlined  in  Citizens  for  a  Better  Environment,  718  F.2d  at 
1 125-26.  The  court  in  Western  Electric  did  not  call  this  standard  into  question.  Indeed,  the  court 
was  not  reviewing  a  new  agency  consent  decree  at  all,  but  instead  was  considering  whether  to 
modify  an  earlier  consent  decree  under  the  terms  established  by  a  judge  in  the  original  antitrust 
case  against  AT&T.  Western  Electric ,  900  F.2d  at  289.  The  phrase  “within  the  reaches  of  the 
public  interest”  refers  to  the  more  relaxed  standard  that  the  court  found  could  be  applied  to 
certain  types  of  modifications  to  antitrust  consent  decrees.  Id.  at  302.  That  test  is  simply  not 
applicable  here. 

The  Government  also  claims  that  EPIC’s  request  for  a  hearing  should  be  disallowed 
because  it  calls  for  judicial  review  similar  to  that  in  the  class  action  context.  But  courts  are 
routinely  required  to  assess  the  fairness,  adequacy,  and  public  interest  of  agency  consent  decrees, 
and  routinely  hold  hearings  to  assist  in  that  assessment,  outside  of  class  action.  See,  e.g.,  Citizens 
for  a  Better  Environment,  718  F.2d  at  1 120;  City  of  Colton  v.  Am.  Promotional  Events,  Inc.,  281 
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F.  Supp.  3d  1099,  1010  (C.D.  Cal.  2017);  In  re:  Volkswagen  "Clean  Diesel” Marketing,  Sales 
Practices,  and  Products  Liab.  Litig.,  MDL  No.  2672,  2017  WL  2214655  (N.D.  Cal.  May  17, 
2017);  United  States  v.  Google  Inc.,  No.  12-04177,  2012  WL  5833994  (N.D.  Cal.  Nov.  16, 

2012);  Turtle  Island  Restoration  Network  v.  U.S.  Dep’t  of  Commerce,  834  F.  Supp.  2d  1004, 

1004  (D.  Haw.  2011);  Northeast  Iowa  Citizens  for  Clean  Water  v.  AgriProcessors,  Inc.,  469  F. 
Supp.  2d  666,  671  (N.D.  Iowa  2006);  Envtl.  Tech.  Council  v.  Browner,  Nos.  94-2119,  94-2346, 
1995  WL  238328,  *1  (D.D.C.  Mar.  8,  1995).  A  hearing  would  aid  the  Court  and  interested 
persons  in  understanding  the  implications  of  the  settlement.  For  instance,  the  effect  of  the 
settlement  on  complaints  brought  under  certain  statutory  provisions,  such  as  COPPA,  is  currently 
unclear. 

II.  EPIC  satisfies  all  requirements  to  intervene  as  of  right  under  FRCP  24(a). 

A.  EPIC  has  a  legally  protected  interest  that  would  be  invaded  by  approval  of 
the  Stipulated  Order. 

Contrary  to  the  Government  and  Facebook’s  assertions,  EPIC  does  not  claim  a  right  to 
enforce  the  FTC  Act  or  the  2012  Consent  Order.  EPIC  does,  however,  have  a  right  to  challenge 
agency  action  under  the  Administrative  Procedures  Act  (“APA”).  Under  the  APA,  courts  have  an 
obligation  to  “hold  unlawful  and  set  aside  agency  action,  findings,  and  conclusions  found  to  be  .  . 
.  arbitrary,  capricious,  an  abuse  of  discretion,  or  otherwise  not  in  accordance  with  law.”  5  U.S.C. 
§  706(2)(A).  EPIC’s  legal  interest  here  is  twofold:  (1)  the  FTC’s  decision  to  grant  Facebook 
immunity  for  unlawful  business  practices  that  EPIC  identified  in  complaints  to  the  agency 
without  addressing  those  practices  in  the  Consent  Decree,  or  even  acknowledging  them  in  the 
complaint,  is  arbitrary  and  capricious  and  harms  both  EPIC  as  an  organization  and  the  privacy 
interests  of  its  members;  and  (2)  the  FTC’s  decision  to  characterize  the  Stipulated  Order  as  an 
amendment  to  the  2012  Consent  Order,  and  not  as  a  new  consent  agreement  requiring  the 
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Commission  to  seek  public  comment,  16  CFR  §  2.34(c)  (“Public  comment:  Promptly  after  its 
acceptance  of  the  consent  agreement,  the  Commission  will  place  the  order  contained  in  the 
consent  agreement,  the  complaint,  and  the  consent  agreement  on  the  public  record  for  a  period  of 
30  days,  or  such  other  period  as  the  Commission  may  specify,  for  the  receipt  of  comments  or 
views  from  any  interested  person.  At  the  same  time,  the  Commission  will  place  on  the  public 
record  an  explanation  of  the  provisions  of  the  order  and  the  relief  to  be  obtained  thereby  and  any 
other  infonnation  that  it  believes  may  help  interested  persons  understand  the  order.  The 
Commission  also  will  publish  the  explanation  in  the  Federal  Register.”)  is  an  unlawful  agency 
action  that  deprives  EPIC  and  others  of  the  opportunity  to  comment  on  the  proposed  Consent 
Decree. 

1.  The  Stipulated  Order  is  arbitrary  and  capricious  because  the 

Commission  seeks  to  grant  Facebook  immunity  from  any  unlawful 
practices  in  prior  consumer  complaints,  without  addressing  or  even 
identifying  the  prior  complaints. 

The  FTC’s  decision  to  grant  a  broad  liability  release  to  Facebook,  after  having  received 
thousands  of  complaints  alleging  that  the  company  engaged  in  unfair  and  deceptive  business 
practices,  is  a  final  agency  action  subject  to  judicial  review.  This  is  not  a  “decision  not  to  initiate 
an  enforcement  action”  exempt  from  judicial  review  under  Heckler  v.  Chaney,  470  U.S.  821 
(1985).  The  proposed  Consent  Decree,  if  adopted,  would  fundamentally  alter  the  legal  rights  and 
responsibilities  of  Facebook  and  of  EPIC  and  other  complainants  who  previously  identified 
business  practices  that  violated  the  FTC  Act  and  the  2012  Consent  Agreement.  The  Consent 
Decree,  like  a  refusal  to  initiate  rulemaking,  is  “less  frequent,  more  apt  to  involve  legal  as 
opposed  to  factual  analysis,  and  subject  to  special  formalities,  including  a  public  explanation.” 
Mass.  v.  EPA,  549  U.S.  497,  527  (2007).  Like  the  petition  denial  in  Mass.  v.  EPA,  the  proposed 
Consent  Decree  also  arises  out  of  complaints  that  EPIC  and  others  “had  an  undoubted  procedural 
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right  to  file  in  the  first  instance.”  Id.;  see  16  C.F.R.  §  2.2.  The  FTC’s  decision  to  issue  the 
stipulated  Consent  Decree  is  therefore  subject  to  judicial  review,  and  the  agency  must  establish 
that  it  had  a  “reasoned  explanation”  for  its  actions.  Mass.  v.  EPA,  549  U.S.  at  534. 

A  “fundamental  requirement  of  administrative  law  is  that  an  agency  set  forth  its  reasons 
for  decision;  an  agency’s  failure  to  do  so  constitutes  arbitrary  and  capricious  agency  action”  and 
warrants  reversal.  Amerijet  Intern.,  Inc.  v.  Pistole,  753  F.3d  1343,  1350  (D.C.  Cir.  2014) 
(internal  quotation  omitted);  accord  Am.  Horse  Prot.  Ass’n,  Inc.  v.  Lyng,  812  F.2d  1,  4-5  (D.C. 
Cir.  1987).  When  denying  a  petition,  an  agency  must  give  “[pjrompt  notice  .  .  .  accompanied  by 
a  brief  statement  of  the  grounds  for  denial.”  5  U.S.C.  §  555(e)  (2012).  This  Court  has  recently 
reaffirmed  that  a  Section  555(e)  statement  must  include,  at  minimum,  an  explanation  of  why  the 
agency  “chose  to  do  what  it  did.”  Amerijet,  753  F.3d  at  1350  (internal  quotation  omitted).  The 
Court  must  ensure  that  an  agency  “has  adequately  explained  the  facts  and  policy  concerns  it 
relied  on”  in  the  order,  and  the  Court  must  be  satisfied  “that  those  facts  have  some  basis  in  the 
record.”  Defs.  of  Wildlife  v.  Gutierrez,  532  F.3d  913,  919  (D.C.  Cir.  2008). 

The  Stipulated  Order  contains  a  blanket  release  of  liability  for  business  practices  that  are 
not  addressed,  or  even  discussed,  in  the  Complaint.  This  liability  waiver  is  a  substantial 
departure  from  past  practice,  see  Dissenting  Statement  of  Commissioner  Rebecca  Slaughter,  In 
re  Facebook,  Inc.,  Commission  File  No.  1823109  at  14  (July  24,  2019)2,  and  is  “arbitrary  and 
capricious”  with  regard  to  the  thousands  of  consumer  privacy  complaints  currently  pending 
before  the  Commission.  Fox  Television  Stations,  Inc.  v.  FCC,  280  F.3d  1027,  1047  (D.C.  Cir. 
2002)  (“although  the  [National  Television  Station  Ownership]  Rule  is  not  unconstitutional,  the 
Commission's  decision  to  retain  it  was  arbitrary  and  capricious  and  contrary  to  law  because  the 

2  https://www.ftc.gOv/public-statements/2019/07/dissenting-statement-commissioner-rebecca-kelly-slaughter- 
regarding-matter. 
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Commission  failed  to  give  an  adequate  reason  for  its  decision,  .  .  .”)  opinion  modified  on  reh  ’g 
on  other  grounds,  293  F.3d  537  (D.C.  Cir.  2002);  see  also  Hermes  Consol.,  LLC  v.  EPA,  787 
F.3d  568,  576  (D.C.  Cir.  2015)  (“An  agency  must  ‘provide  reasoned  explanation  for  its  action,’ 
which  normally  requires  ‘that  it  display  awareness  that  it  is  changing  position.’”).  The  FTC  has 
not  provided  any  reasoned  explanation  for  rejecting  the  complaints  that  EPIC  and  other 
consumer  groups  submitted,  nor  has  the  Commission  offered  any  reasoned  explanation  for 
granting  a  broad  immunity  to  Facebook  for  past  violations.  It  is  arbitrary  and  capricious  for  the 
Commission  to  indemnify  Facebook  for  violations,  currently  pending  before  the  Commission, 
that  the  Commission  has  failed  to  acknowledge. 

In  her  dissent  to  the  proposed  settlement,  Commissioner  Slaughter  noted  that  “in  every 
recent  major  federal  settlement,  if  there  was  a  liability  release,  it  was  cabined  to  the  offenses 
described  in  the  complaint.”  Dissenting  Statement  of  Commissioner  Rebecca  Slaughter,  In  re 
Facebook,  Inc.,  Commission  File  No.  1823109  at  14  (July  24,  2019).  Commissioner  Slaughter 
cited  to  six  prior  consent  decrees  that  limit  the  scope  of  liability  release  to  the  conduct  described 
in  the  complaint.  Consent  Decree  ]fl[  61,  64,  In  re:  Oil  Spill  by  the  Oil  Rig  “ Deepwater  Horizon  ” 
in  the  Gulf  of  Mexico  on  April  20,  2010,  No.  2:10-md-02179-CJB-SS  (E.D.  La.  filed  Oct.  5, 

20 1 5);3  Stipulation  and  Order  of  Settlement  and  Dismissal  with  Prejudice  at  3,  United  States  v. 
Wells  Fargo  Bank,  No.  1 : 12-cv-07527-JMF  (S.D.N.Y.  filed  Apr.  8,  2016)4;  Stipulation  and 
Order  of  Settlement  and  Dismissal  at  3,  6,  10,  United  States  ex  rel.  Hunt  v.  Citigroup,  No. 

l:ll-cv-05473-VM  (S.D.N.Y.  filed  Feb.  15,  2012)5;  Settlement  Agreement  at  2-5,  8-11,  United 
States  ex  rel.  Thorpe  v.  GlaxoSmithKline,  No.  1 1-10398-RWZ  (D.  Mass,  filed  July  2,  2012)6; 

3  https://www.epa.gov/sites/production/files/2016-02/documents/deepwaterhorizon-cd.pdf 

4  https://www.justice.gov/opa/file/839796/download. 

5  https://www.jiistice.gov/archive/usao/nys/pressreleases/Febmaiyl2/citi/citimortgageincsettlementagreement.pdf 

6  https://www.justice.gov/sites/default/files/opa/legacy/2012/07/02/avandia-agreement.pdf. 
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Consent  Judgment  at  Ex.  E  ]{  B,  CFPB  v.  Ocwen  Fin.,  No.  1 : 13-cv-02025-RMC  (D.D.C.  filed 
Feb.  26,  20 14)7;  Consent  Decree  203-204,  211,  United  States  v.  Chevron  U.S.A.,  No.  3:03- 
cv-04650-CRB  (N.D.  Cal.  fded  June  29,  2005).8 

The  statement  from  Chairman  Simons,  Commissioner  Phillips,  and  Commissioner 
Wilson  attempt  to  respond  to  this  argument  with  the  assertion  that  “Releases  are  a  practical 
reality  of  settlements  and  are  used  as  bargaining  chips  during  negotiations  to  extract  the  desired 
relief  from  a  defendant.”  Statement  of  Statement  of  Chairman  Joe  Simons  and  Commissioners 
Noah  Joshua  Phillips  and  Christine  S.  Wilson,  In  re  Facebook,  Inc.,  Commission  File  No. 
1823109  at  7  (July  24,  20 19). 9  This  statement  alone  is  insufficient  to  support  such  a  broad 
release.  Reasoned  decisionmaking  requires  more  than  a  simple  statement  of  an  agency’s 
determination.  “[Cjonclusory  statements  will  not  do;  an  agency’s  statement  must  be  one  of 
reasoning.”  Amerijet,  753  F.3d  at  1350  (internal  quotation  omitted).  Sparse,  conclusory 
statements  are  “insufficient  to  assure  a  reviewing  court  that  the  agency’s  refusal  to  act  was  the 
product  of  reasoned  decisionmaking.”  Am.  Horse,  812  F.2d  at  6.  In  addition,  an  agency’s 
“reasons  for  action  or  inaction  must  conform  to  the  authorizing  statute.”  Massachusetts  v.  EPA, 
549  U.S.  497,  533  (2007). 

Neither  of  the  prior  releases  referenced  in  the  majority  statement  are  as  broad  as  the 
Facebook  release.  The  release  in  Barclays  Capital  was  limited  to  conduct  alleged  in  the 
complaint  and  similar  conduct  related  to  other  residential  mortgage-backed  securities  deals. 
Agreement  for  Compromise  Settlement  and  Release,  United  States  v.  Barclays  Capital,  Inc.,  No. 
16-CV-7057(KAM/JO)  (E.D.N.Y.  Apr.  24,  2018),  ECF  No.  137.  Similarly,  the  release  in  Wells 

1  https://files.consumei'fmance.gov/f/201403_cfpb_entered-judgment-with-exhibits_ocwen.pdf 

8  https://www.epa.gov/sites/prodiiction/files/documents/chevron-cd.pdf. 

9  https://www.ftc.gOv/piiblic-statements/2019/07/statement-chairman-joe-simons-commissioners-noah-joshua- 
phillips-christine. 
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Fargo  was  limited  to  conduct  alleged  in  the  complaint  and  similar  conduct  relating  to  single¬ 
family  residential  FHA  loans.  United  States  v.  Wells  Fargo  Bank,  N.A.,  No.  12CIV7527JMFJCF 
(S.D.N.Y.  Apr.  8,  2016),  ECF  No.  320.  Indeed,  Commissioner  Slaughter  cited  the  Wells  Fargo 
case  in  dissent  because  the  Commission  in  that  case  did  limit  the  scope  of  conduct  released. 
Dissenting  Statement  of  Commissioner  Rebecca  Slaughter,  In  re  Facebook,  Inc.,  Commission 
File  No.  1823109  at  14  note  36  (July  24,  2019). 10 

If  the  commission  were  to  follow  the  precedent  of  the  two  cases  cited,  it  would  cabin  the 
release  to  certain  allegations  or  conduct,  such  as  violations  related  to  facial  recognition, 
explicitly  described  in  the  Stipulated  Order.  But  instead,  the  stipulated  order  resolves  all  claims 
that  Facebook  violated  the  2012  Consent  Order  and  all  consumer-protection  claims  that 
Facebook  violated  Section  5  of  the  FTC  Act  known  by  the  FTC  prior  to  June  12,  2019. 

Stipulated  Order,  ECF  No.  2-1,  regardless  of  whether  the  agency  actually  investigated  the  claims 
it  had  received. 

The  unjustifiably  broad  release  grants  Facebook  immunity  for  behavior  described  in  the 
EPIC  complaints  without  addressing  the  behavior  in  the  Complaint  or  Stipulated  Order.  For 
example,  the  FTC  did  not  address  EPIC’s  complaint  concerning  Facebook's  manipulation  of 
users’  News  Feeds  for  psychological  research.  Complaint,  In  re  Facebook,  Inc.  (July  3,  20 14). 11 
The  FTC  also  did  not  address  EPIC’s  complaints  concerning  WhatsApp.  Complaint,  In  re 
WhatsApp,  Inc.  (Mar.  6,  2014). 12  Complaint,  In  re  WhatsApp,  Inc.  (Aug  29,  2016). 13  The 
Commission’s  arbitrary  and  capricious  release  of  Facebook’s  liability  for  the  business  practices 


10  https://www.ftc.gov/public-statements/2019/07/dissenting-statement-commissioner-rebecca-kelly-slaughter- 
regarding-matter. 

11  https://epic.org/privacy/internet/ftc/facebook/psycho/Facebook-Sbidy-Complaint.pdf. 

12  https://epic.org/privacy/ftc/whatsapp/WhatsApp-Complaint.pdf. 

13  https://epic.org/privacy/ftc/whatsapp/EPIC-CDD-FTC-WhatsApp-Complaint-2016.pdf. 
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identified  in  EPIC’s  complaints  is  an  invasion  of  EPIC’s  legally  protected  interests  under  the 
APA. 

2.  The  Stipulated  Order  is  unlawful  because  it  contains  a  new  consent 
agreement  that  does  not  adhere  to  APA  comment  and  review  process 

The  FTC’s  own  regulations  require  the  Commission  to  place  consent  agreements  on  the 
public  record  for  a  thirty-day  comment  period.  16  C.F.R.  §  2.34(c)  (“Public  Comment”).  The 
proposed  Stipulated  Order  in  this  case  is  both  monetary  penalty  for  violations  of  the  2012 
Consent  Order  and  a  new  consent  agreement  (described  as  a  “modification”).  The  FTC  in  its 
Complaint  alleges  new  violations  of  Section  5  by  Facebook — e.g.  Count  6  of  the  Complaint 
alleges  that  Facebook  engaged  in  deceptive  practices  regarding  use  of  covered  information 
provided  for  account  security.  The  FTC  cannot  simply  sidestep  the  public  comment  process  by 
routing  its  consent  order  through  a  settlement  agreement. 

EPIC  routinely  comments  on  FTC  consent  agreements,  making  recommendations  on 
changes  to  the  agreement  that  would  improve  user  privacy.  EPIC  submitted  comments  to  urge 
the  FTC  to  strengthen  the  original  Facebook  order.  EPIC,  Comments  In  re  Facebook,  Inc.,  FTC 
File  No.  092  3184  (201 1). 14  Specifically,  EPIC's  recommended  that  the  FTC  require  Facebook  to 
(1)  allow  users  to  access  all  of  the  data  that  Facebook  keeps  about  them;  (2)  cease  creating  facial 
recognition  profiles  without  users'  affirmative  consent;  (3)  make  Facebook's  privacy  audits 
publicly  available  to  the  greatest  extent  possible;  and  (4)  cease  secret  post-log  out  tracking  of 
users  across  websites.  But  the  FTC  adopted  the  order  without  any  modifications  to  the  order. 
However,  the  FTC  has  modified  other  orders  concerning  privacy  in  response  to  public 


14  https://epic.org/privacy/facebookyFacebook-FTC-Settlement-Comments-FINAL.pdf 
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comments.  In  the  Matter  ofUber  Technologies,  Inc.  Decision  and  Order,  Docket  No.  C-4662 
(Oct.  25,  2018). 15 

The  FTC’s  attempt  to  circumvent  the  public  comment  process  is  unlawful  and  denies 
EPIC  and  others  the  opportunity  to  submit  comments  on  the  consent  agreement. 

B.  EPIC  has  Article  III  standing  to  intervene  as  of  right. 

Because  EPIC  has  demonstrated  a  legally  protected  interest  under  Rule  24(a),  EPIC  also 
has  Article  III  standing.  See,  e.g.,  Wildearth  Guardians  v.  Salazar,  272  F.R.D.  4,  13  n.  5  (D.D.C. 
2010)  (“[W]hen  a  putative  intervenor  has  a  ‘legally  protected’  interest  under  Rule  24(a),  it  will 
also  meet  constitutional  standing  requirements,  and  vice  versa.  ”).  EPIC  can  also  meet  the 
requirements  of  Article  III  standing  because  it  will  (1)  suffer  an  injury  in  fact,  (2)  that  is  fairly 
traceable  to  entrance  of  the  Stipulate  Order,  and  (3)  that  is  likely  to  be  redressed  by  a  favorable 
decision  by  this  Court.  Spokeo  v.  Robins,  136  S.  Ct.  1540,  1547  (2016)  (citing  Lujan  v. 

Defenders  of  Wildlife,  504  U.S.  555,  560  (1992)).  As  an  organization,  EPIC  “can  assert  standing 
on  its  own  behalf,  on  behalf  of  its  members  or  both.”  PETA  v.  USDA,  797  F.3d  1087,  1093  (D.C. 
Cir.  2015).  Here,  EPIC,  as  an  organization,  will  suffer  two  injuries  if  the  Stipulated  Order  is 
entered:  (1)  EPIC  will  be  prevented  from  seeking  redress  through  the  administrative  complaint 
process  for  Facebook’s  violations  of  Section  5  of  the  FTC  Act  contained  in  the  proposed 
settlement’s  broad  liability  release;  and  (2)  EPIC  will  be  deprived  of  the  opportunity  to  submit 
comments  on  the  proposed  settlement,  as  required  by  the  FTC’s  regulations. 

As  a  preliminary  matter,  the  Government’s  assertion  that  the  decision  to  settle  with 
Facebook  is  “generally  not  reviewable”  and  thus  cannot  result  in  injury  to  EPIC  does  not 
comport  with  Circuit  precedent  on  judicial  approval  of  agency  consent  decrees,  as  discussed  in 

15  https://www.ftc.gov/system/files/documents/cases/152_3054_c- 
4662_uber_technologies_revised_decision_and_order.pdf 
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Section  I  above.  This  Court  is  required  to  review  proposed  consent  decrees  for  fairness, 
adequacy,  and  consistency  with  the  public  interest.  Citizens  for  a  Better  Env’t,  718  F.  2d  at  1 126 
(citing  United  States  v.  Trucking  Employers,  Inc.,  561  F.2d  313,  317  (D.C.  Cir.  1977).  While 
“the  function  of  the  reviewing  court  is  not  to  substitute  its  judgment  for  that  of  the  parties  to  the 
decree,”  United  States  v.  District  of  Columbia ,  933  F.  Supp.  at  46-47,  the  Court  “must  eschew 
any  rubber  stamp  approval  in  favor  of  an  independent  evaluation.”  Id.  at  47  (quoting  United 
States  v.  Hooker  Chemicals  and  Plastics  Corporation,  540  F.  Supp.  1067,  1072  (W.D.N.Y. 

1982),  affd,  749  F.2d  968  (2d  Cir.  1984)).  Under  this  standard,  this  Court  must  assure  itself  that 
the  proposed  settlement  is  consistent  with  the  APA,  as  it  is  difficult  to  see  how  a  settlement  that 
violates  the  APA  could  be  fair,  adequate,  or  consistent  with  the  public  interest.  Thus,  the 
standard  of  review  does  not  deprive  EPIC  of  a  legal  interest  in  this  case. 

Adoption  of  the  Stipulated  Order  will  cause  EPIC,  as  an  organization,  to  suffer  a 
“concrete  and  demonstrable  injury  to  [its]  activities,”  that  goes  beyond  “a  mere  setback  to 
[EPIC's]  abstract  social  interests.”  PETA,  797  F.3d  at  1093.  The  FTC’s  proposed  Consent  Decree 
grants  Facebook  broad  immunity  for  past  violations  of  the  FTC  Act  and  the  2012  Consent  Order 
without  addressing  the  claims  that  provide  the  basis  for  the  release  of  liability.  If  the  release  goes 
into  force,  then  EPIC  will  be  unable  to  file  future  complaints  concerning  Facebook’s  unlawful 
business  practices  during  the  period  of  2012  to  2019.  The  FTC’s  proposed  Consent  Decree  also 
bypasses  the  APA’s  comment  and  review  process,  injure  EPIC’s  interests,  and  cause  EPIC  to 
“use[]  its  resources  to  counteract  that  harm.”  Id. 

First,  the  overly  broad  liability  release  impedes  EPIC’s  ability  to  prevent  invasions  of 
privacy  through  the  administrative  complaint  process.  EPIC’s  mission  is  to  “protect  privacy, 
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freedom  of  expression,  and  democratic  values  in  the  information  age.”  EPIC,  About  (20 19). 16 
EPIC  routinely  submits  complaints  to  the  FTC  concerning  the  privacy-violating  behavior  of 
Facebook  and  other  businesses,  and  the  FTC  often  acts  upon  these  complaints  in  enforcement 
actions.  The  grant  of  immunity  here  means  that  the  FTC  has  foreclosed, forever,  any 
enforcement  action  on  the  matters  detailed  in  EPIC’s  previously-submitted  complaints,  as  well  as 
those  contained  in  26,000  other  consumer  complaints.  The  release  also  immunizes  Facebook 
from  any  new  complaints  that  EPIC  might  seek  to  file  regarding  unlawful  past  conduct.  As  a 
result  of  the  FTC’s  release,  EPIC,  as  an  organization,  would  suffer  an  injury  similar  to  the  one  in 
PETA,  where  this  Circuit  found  that  PETA  had  organizational  standing  because  the  USDA’s 
refusal  to  apply  the  Animal  Welfare  Act  to  birds  “precluded  PETA  from  preventing  cruelty  to 
and  inhumane  treatment  of  these  animals  through  its  nonnal  process  of  submitting  USD  A 
complaints.” /</.  at  1094. 

EPIC  will  also  be  denied  “a  means  by  which  to  seek  redress”  for  any  of  Facebook’s 
Section  5  violations  detailed  in  the  previous  complaints,  and  will  no  longer  have  a  means  of 
bringing  these  “violations  to  the  attention  of  the  agency  charged  with  preventing”  them.  Id.  at 
1095.  EPIC  instead  will  be  forced  to  redirect  resources  to  researching  and  pursuing  other  means 
of  redressing  Facebook’s  privacy-invading  behavior  and  to  mitigating  the  harm,  such  as  public 
education  on  the  behavior  and  how  to  avoid  hann,  pressure  campaigns  to  directly  force  Facebook 
to  stop  the  behavior,  state-level  enforcement  of  consumer  privacy  laws,  and  legislative  action  to 
create  alternative  means  to  enforce  the  law  against  Facebook.  These  expenditures  will  thus  be 
undertaken  “in  response  to,  and  to  counteract,  the  effects”  of  the  broad  liability  waiver  “rather 


16https://epic.org/epic/about.html. 
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than  in  anticipation  of  litigation.”  Equal  Rights  Ctr.  v.  Post  Properties,  Inc.,  633  F.  3d  1 136, 

1140  (D.C.  Cir.  2011). 

EPIC’s  injury  is  fairly  traceable  to  the  proposed  settlement  because  it  is  through  the 
settlement  that  the  FTC  waives  its  authority  to  enforce  Section  5  against  Facebook  for  behavior 
contained  in  complaints  submitted  prior  to  June  12,  2019.  EPIC  would  not  have  to  expend 
resources  pursuing  alternative  means  of  enforcement  or  mitigation  of  harm  if  the  FTC  did  not 
waive  its  right  to  regulate  Facebook’s  relevant  behavior.  This  Court  can  also  redress  EPIC’s 
injury  by  not  approving  the  Stipulated  Order  with  a  broad  liability  release,  as  EPIC  will  continue 
to  be  able  to  bring  Facebook’s  relevant  Section  5  violations  to  the  attention  of  the  Commission. 

The  grant  of  immunity  here  is  different  than  a  refusal  to  take  enforcement  action.  In  the 
latter  situation,  the  FTC  could  respond  to  a  new  complaint  or  new  evidence,  or  simply  exercise 
its  discretionary  authority  to  act.  With  a  grant  of  immunity,  no  new  complaint  from  EPIC  will  re¬ 
establish  the  FTC’s  authority  to  act  upon  even  the  most  obvious  and  egregious  of  violations.  This 
case  is  thus  distinguishable  from  cases  where  an  agency  has  chosen  not  to  enforce.  See,  e.g., 
Heckler  v.  Chaney,  470  U.S.  821,  831  (1985)  (“An  agency’s  decision  not  to  prosecute  or  enforce 
...  is  a  decision  generally  committed  to  an  agency’s  absolute  discretion.”)  It  is  also 
distinguishable  from  EPIC  v.  FAA,  829  F.3d  1249  (D.C.  Cir.  2018),  as  EPIC’s  inability  to  file 
complaints  is  not  an  “abstract  social  interest”  because  EPIC  not  only  alleges  “impediments  to 
‘pure  issue-advocacy,”’  but  prevention  from  pursuing  a  key  programmatic  activity:  seeking  FTC 
redress  for  Facebook  Section  5  violations  within  the  broad  liability  release  through  the 
administrative  complaint  process.  Id.  at  1255  (citations  omitted). 

EPIC,  as  an  organization,  is  also  be  hanned  because  it  is  deprived  of  an  opportunity  to 
comment  on  the  settlement  agreement  through  the  FTC’s  comment  and  review  process.  As 
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described  above,  the  FTC  is  required  to  “place  the  order  contained  in  the  consent  agreement,  the 
complaint,  and  the  consent  agreement  on  the  public  record  for  a  period  of  30  days,  or  such  other 
period  as  the  Commission  may  specify,  for  the  receipt  of  comments  or  views  from  any  interested 
person.”  16  C.F.R.  §  2.34(c).  EPIC  has  a  long  history  of  commenting  on  proposed  FTC 
settlements.  See,  e.g.,  Comments  of  EPIC,  In  the  Matter  of  Uber  Technologies,  Inc.,  Fed.  Trade 
Comin’n,  FTC  File  No.  153-3054  (May  14,  20 1 8); 17  Comments  of  EPIC,  In  the  Matter  of 
PayPal,  Inc.,  Fed.  Trade  Comm’n,  FTC  File  No.  162-3102  (Mar.  29,  20 18); 18  Comments  of 
EPIC,  In  the  Matter  of  Uber  Technologies,  Fed.  Trade  Comm’n,  FTC  File  No.  152-3054  (Sep. 

15,  2017);19  Comments  of  EPIC,  In  the  Matter  of  Snapchat,  Inc.,  Fed.  Trade  Comm’n,  FTC  File 
No.  132-3078  (June  9,  2014);20  Comments  of  EPIC,  On  Rent-to-Own  Computer  Spying 
Proposed  Settlements,  Fed.  Trade  Comm’n,  Docket  No.  FTC  File  No.  1 12-3151  (October  25, 
2012);21  Comments  of  EPIC,  In  the  Matter  of  Facebook,  Inc.,  Fed.  Trade  Comm’n,  FTC  File  No. 
092-3184  (Dec.  27,  201 1);22  Comments  of  EPIC,  In  the  Matter  of  Reed  Elsevier,  Inc.  and  Seisint, 
Inc.  Consent  Order;  In  the  Matter  of  The  TJX  Companies,  Inc.  Consent  Order,  Fed.  Trade 
Comm’n,  Docket  No.  052-3094;  072-3055  (April  28,  2008);23  Comments  of  EPIC,  In  the  Matter 
of  Microsoft  Consent  Order,  Fed.  Trade  Comm’n,  FTC  File  No.  012-3240,  M03  (September  9, 
2002). 24  EPIC  would  comment  on  the  proposed  settlement  here  if  it  were  submitted  through  the 
process  required  by  law.  Submitting  these  comments  is  an  important  aspect  of  EPIC’s  program 
to  advocate  for  consumer  privacy  interests  before  the  FTC. 


17  https://epic.org/privacy/intemet/ftc/uber/EPIC-FTC-Revised-Uber-Settlement.pdf. 

18  https://epic.org/apa/comments/EPIC-FTC-PayPal-ConsentOrder.pdf. 

19  https://epic.org/apa/comments/EPIC-FTC-Uber-Settlement.pdf. 

20  https://epic.org/privacy/ftc/FTC-Snapchat-Cmts.pdf. 

21  https://epic.org/privacy/ftc/EPIC-Designerware-Cmts.pdf. 

22  https://epic.org/privacy/facebook/Facebook-FTC-Settlement-Comments-FINAL.pdf. 

23  https://epic.org/apa/comments/042808_ftc.pdf. 

24  https://epic.org/privacy/consumer/microsoft/ordercomments.html. 
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Because  the  FTC  can  modify  or  withdraw  the  agreement  in  response  to  comments 
received,  16  C.F.R.  §  2.34(e),  the  Commission’s  decision  not  to  follow  its  own  regulation 
deprives  EPIC  of  an  opportunity  to  influence  the  FTC’s  decision  making  on  the  proposed 
settlement.  In  response  to  this  deprivation,  EPIC  has  had  to  pursue  alternative  means  to  be  heard, 
including  this  motion  to  intervene,  which  would  not  have  been  necessary  had  the  FTC  opened 
the  settlement  to  public  comment.  An  order  by  this  Court  directing  the  FTC  to  submit  the 
proposed  settlement  for  public  comment  would  clearly  remedy  EPIC’s  injury  as  EPIC  would 
have  the  opportunity  to  submit  comments. 

C.  EPIC  satisfies  the  other  requirements  of  FCRA  24(a). 

EPIC  also  satisfies  the  other  requirements  for  intervention  as  of  right,  namely,  EPIC’s 
motion  is  timely  and  the  FTC  would  not  adequately  represent  EPIC’s  interests.  Neither  the 
Government  nor  Facebook  challenge  the  timeliness  of  EPIC’s  motion  under  FCRA  24(a).  The 
Government  argues  that  it  adequately  represents  EPIC’s  interests  because  there  is  a  presumption 
that  the  government  adequately  represents  the  interests  of  the  public  under  the  circumstances 
here.  But  surely  the  Government  cannot  adequately  represent  EPIC  in  its  claims  that  the 
Government  has  acted  contrary  to  the  law  in  releasing  Facebook  from  liability  for  behavior  not 
addressed  in  the  Complaint  or  Consent  Decree,  or  for  violating  its  own  regulations  in  not  seeking 
public  comment  on  the  settlement. 

D.  EPIC  also  meets  the  requirements  of  permissive  intervention. 

EPIC  satisfies  the  requirements  for  permissive  intervention  because  EPIC  has  (1)  an 
independent  ground  for  subject  matter  jurisdiction;  (2)  a  timely  motion;  and  (3)  a  claim  or 
defense  that  has  a  question  of  law  or  fact  in  common  with  the  main  action. 

EPIC  does  not  claim  federal  question  jurisdiction  to  bring  a  case  under  the  FTC  Act,  but 
under  the  APA.  EPIC’s  claims  under  the  APA  have  questions  of  law  and  fact  in  common  with 
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the  inquiry  this  Court  must  consider  in  determining  whether  to  enter  the  Consent  Decree, 
namely,  the  settlement's  “overall  fairness  to  beneficiaries  and  consistency  with  the  public 
interest,”  Citizens  for  a  Better  Environment  v.  Gorsuch,  718  F.2d  1117,  1 126  (D.C.Cir.  1983), 
and  whether  the  consent  decree  “conform[s]  to  applicable  laws.”  United  States  v.  State  of 
Oregon,  913  F.2d  576,  580-81  (9th  Cir.  1990)  (citations  omitted).  A  party  need  not  be  essential 
to  be  granted  pennissive  intervention.  Sierra  Club  v.  McCarthy,  308  F.R.D.  9,  12  (D.D.C.  2015). 

It  is  also  unclear  how  EPIC’s  motion — filed  mere  days  after  the  government  filed  this 
action — could  “unduly  delay  or  prejudice  the  adjudication  of  the  original  parties’  rights.”  Fed.  R. 
Civ.  P.  24(b)(3).  The  Government  and  Facebook  merely  assert,  without  explaining,  that  EPIC’s 
participation  would  be  disruptive.  This  Court  must  assure  itself  that  the  consent  decree  is  fair, 
reasonable,  and  in  the  public  interest — which  it  has  yet  to  do.  As  argued  above,  EPIC’s 
participation  would  aid  the  Court  in  making  this  assessment,  not  hinder  it.  Facebook’s  claim  that 
granting  EPIC’s  motion  would  require  the  Court  to  grant  every  member  of  the  public  with  an 
opposing  view  the  opportunity  to  intervene  is  hyperbolic.  Rather,  EPIC’s  status  as  the  filer  of 
complaints  that  will  be  extinguished  by  the  settlement,  and  EPIC’s  technical  expertise  in  privacy 
and  Facebook’s  behavior,  put  EPIC  in  a  unique  position  to  assert  claims  in  this  proceeding. 

CONCLUSION 

For  the  above  stated  reasons,  the  Court  should  grant  EPIC’s  motion  to  intervene, 
establish  a  briefing  schedule  for  intervenors  and  interested  parties,  and  schedule  a  hearing  to 
review  the  fairness  and  adequacy  of  the  parties’  proposed  consent  decree. 

Respectfully  Submitted, 

MARC  ROTENBERG,  D.C.  Bar  #422825 
EPIC  President  and  Executive  Director 


17 


Case  l:19-cv-02184-TJK  Document  13  Filed  08/12/19  Page  18  of  18 


/s/  Alan  Butler _ 

ALAN  BUTLER,  D.C.  Bar  #1012128 
EPIC  Senior  Counsel 

MEGAN  IORIO,  D.C.  Bar  #1618365 
EPIC  Appellate  Advocacy  Counsel 

ELECTRONIC  PRIVACY 
INFORMATION  CENTER 
1519  New  Hampshire  Ave.,  N.W. 
Washington,  D.C.  20036 
(202)  483-1140  (telephone) 

(202)  483-1248  (facsimile) 

Attorneys  for  Plaintiff  EPIC 25 


Dated:  Aug.  12,  2019 


25  EPIC  Consumer  Protection  Counsel  Christine  Bannan,  a  member  of  the  Massachusetts  Bar 
whose  admission  is  pending  in  the  District  of  Columbia,  contributed  to  this  brief. 
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IN  THE  UNITED  STATES  DISTRICT  COURT 
FOR  THE  DISTRICT  OF  COLUMBIA 


UNITED  STATES  OF  AMERICA, 

Plaintiff, 

v.  Civ.  Action  No.  l:19-cv-02 184 

FACEBOOK  INC., 

Defendant. 


ELECTRONIC  PRIVACY  INFORMATION  CENTER 
1519  New  Hampshire  Avenue,  N.W. 

Washington,  D.C.  20036 

Intervenor-Plaintiff, 

v. 

Civ.  Action  No.  19-2184 

FEDERAL  TRADE  COMMISSION, 

600  Pennsylvania  Avenue,  N.W. 

Washington,  D.C.  20580 

Intervenor-Defendant. 


COMPLAINT  IN  INTERVENTION 

Intervenor-Plaintiff  Electronic  Privacy  Infonnation  Center  (“EPIC”),  by  way  of  this 
Complaint  in  Intervention  against  the  Intervenor-Defendant  Federal  Trade  Commission  (“FTC”) 
states  and  alleges  as  follows: 

Parties 

1.  Intervenor-Plaintiff  EPIC  is  a  nonprofit  organization,  incorporated  in  Washington,  D.C., 
established  in  1994  to  focus  public  attention  on  emerging  privacy  and  civil  liberties  issues. 
Central  to  EPIC’s  mission  is  advocacy  to  protect  consumer  privacy.  EPIC  is  a  membership 
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organization.  The  Members  of  EPIC’s  Advisory  Board  include  distinguished  experts  in  law, 
technology,  and  public  policy. 

2.  An  important  aspect  of  EPIC’s  consumer  protection  program  is  submission  of  complaints 
to  the  FTC.  EPIC  filed  the  original  complaints  that  led  to  the  FTC’s  2012  Consent  Order  with 
Facebook.  Since  the  adoption  of  the  2012  Consent  Order,  EPIC  has  submitted  numerous 
complaints  to  the  FTC  alleging  that  Facebook  violated  Section  5  of  the  FTC  Act  and  the  2012 
Consent  Order.1  EPIC  also  routinely  comments  on  proposed  FTC  settlements  implicating 
privacy.2 


1  See  Complaint,  In  re  Facebook,  Inc.  and  Facial  Recognition  (Apr.  6,  2018), 
https://epic.org/privacy/facebook/FTC-Facebook-FR-Complaint-04062018.pdf;  Fetter  from 
EPIC  et  al.  to  Maureen  Ohlhausen,  Acting  Chairman,  FTC,  and  Terrell  McSweeney, 
Commissioner,  FTC  (Mar.  20,  2018),  https://epic.org/privacy/facebook/EPIC-et-al-ltr-FTC- 
Cambridge-FB-03-20-18.pdf;  Complaint,  In  re  WhatsApp,  Inc.  (Aug  29,  2016), 
https://epic .  org/privacy/ ftc/whatsapp/EPIC-CDD-FTC- Whats  App-Complaint-20 1 6  .pdf; 
Complaint,  In  re  Facebook,  Inc.  (July  3,  2014), 

https://epic.org/privacy/internet/ftc/facebook/psycho/Facebook-Study-Complaint.pdf;  Complaint, 
In  re  WhatsApp,  Inc.  (Mar.  6,  2014),  https://epic.org/privacy/ftc/whatsapp/WhatsApp- 
Complaint.pdf. 

2  See,  e.g.,  Comments  of  EPIC,  In  the  Matter  of  Uber  Technologies,  Inc.,  Fed.  Trade  Comrn’n, 
FTC  File  No.  153-3054  (May  14,  2018),  https://epic.org/privacy/internet/ftc/uber/EPIC-FTC- 
Revised-Uber-Settlement.pdf;  Comments  of  EPIC,  In  the  Matter  of  PayPal,  Inc.,  Fed.  Trade 
Comin’n,  FTC  File  No.  162-3102  (Mar.  29,  2018),  https://epic.org/apa/comments/EPIC-FTC- 
PayPal-ConsentOrder.pdf;  Comments  of  EPIC,  In  the  Matter  of  Uber  Technologies,  Fed.  Trade 
Comin’n,  FTC  File  No.  152-3054  (Sep.  15,  2017),  https://epic.org/apa/comments/EPIC-FTC- 
Uber-Settlement.pdf;  Comments  of  EPIC,  In  the  Matter  of  Snapchat,  Inc.,  Fed.  Trade  Comm’n, 
FTC  File  No.  132-3078  (June  9,  2014),  https://epic.org/privacy/ftc/FTC-Snapchat-Cmts.pdf; 
Comments  of  EPIC,  On  Rent-to-Own  Computer  Spying  Proposed  Settlements,  Fed.  Trade 
Comm’n,  Docket  No.  FTC  File  No.  112-3151  (October  25,  2012), 

https://epic.org/privacy/ftc/EPIC-Designerware-Cmts.pdf;  Comments  of  EPIC,  In  the  Matter  of 
Facebook,  Inc.,  Fed.  Trade  Comm’n,  FTC  File  No.  092-3184  (Dec.  27,  2011), 
https://epic.org/privacy/facebook/Facebook-FTC-Settlement-Comments-FINAL.pdf;  Comments 
of  EPIC,  In  the  Matter  of  Reed  Elsevier,  Inc.  and  Seisint,  Inc.  Consent  Order;  In  the  Matter  of 
The  TJX  Companies,  Inc.  Consent  Order,  Fed.  Trade  Comm’n,  Docket  No.  052-3094;  072-3055 
(April  28,  2008),  https://epic.org/apa/comments/042808_ftc.pdf;  Comments  of  EPIC,  In  the 
Matter  of  Microsoft  Consent  Order,  Fed.  Trade  Comm’n,  FTC  File  No.  012-3240,  M03 
(September  9,  2002),  https://epic.org/privacy/consumer/microsoft/ordercomments.html. 
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3.  Intervenor-Defendant  FTC  is  an  agency  within  the  meaning  of  5  U.S.C.  §§  701  and  55 1 
and  is  the  plaintiff  in  this  action  sub  nom  United  States  of  America. 

Jurisdiction  and  Venue 

4.  This  is  an  action  in  intervention  in  the  above-captioned  suit  as  filed  by  Plaintiff  United 
States  of  America  (on  behalf  of  the  FTC).  That  action  arises  under  the  FTC  Act,  15  U.S.C.  §§ 
45(a)  and  (1),  and  the  Commission  seeks  monetary  and  injunctive  relief  for  Facebook’s  alleged 
unfair  and  deceptive  trade  practices  and  violation  of  the  2012  Consent  Order. 

5.  This  Court  had  and  has  subject  matter  jurisdiction  over  the  FTC’s  Complaint  under  28 
U.S.C.  §§  1331,  1337(a),  1345,  and  1355;  and  15  U.S.C.  §§  45(a)  and  (1),  and  56(a)(1). 

6.  Venue  is  proper  in  this  district  under  28  U.S.C.  §§  1391(b)(2),  (c)(2),  and  1395(a);  and  15 
U.S.C.  §  53(b). 

7.  This  Complaint  in  Intervention  will  be  submitted  only  pursuant  to  order  of  this  Court,  if 
the  Court  grants  the  Motion  for  Intervention  under  Fed.  R.  Civ.  P.  24  filed  by  EPIC  in  this  suit. 

8.  This  Complaint  in  Intervention  comprises  an  action  arising  under  the  Administrative 
Procedure  Act  (“APA”),  5  U.S.C.  §§  551-706  and  the  Declaratory  Judgment  Act,  28  U.S.C.  § 
2201(a)  for  injunctive  and  other  appropriate  relief  to  challenge  entry  of  the  proposed  Consent 
Decree  between  the  FTC  and  Facebook,  Inc.  (“Facebook”).  Specifically  EPIC  challenges  (a) 
Intervenor-Defendant’s  arbitrary  and  capricious  decision  to  grant  Facebook  a  liability  waiver  for 
all  complaints  filed  with  the  Commission  prior  to  June  12,  2019,  without  reasoned  explanation, 
in  violation  of  5  U.S.C.  §  706(2)(A);  and  (b)  Intervenor-Defendants’  failure  to  “place  the  order 
contained  in  the  consent  agreement,  the  complaint,  and  the  consent  agreement  on  the  public 
record  for  a  period  of  30  days,  or  such  other  period  as  the  Commission  may  specify  for  the 
receipt  of  comments  or  views  from  any  interested  person,”  as  required  by  16  C.F.R.  §  2.34(c). 
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9.  The  Court  has  subject  matter  jurisdiction  over  EPIC’s  Complaint  in  Intervention  under  28 
U.S.C.  §  1331,  5  U.S.C.  §  702,  and  5  U.S.C.  §  704.  This  Court  has  personal  jurisdiction  over  the 
Intervenor-Defendant. 

10.  EPIC  has  standing  to  bring  this  Claim  in  Intervention  because  it  has  been,  and  continues 
to  be,  adversely  affected  by  the  proposed  FTC-Facebook  Consent  Decree. 

Facts 

1 1 .  This  Complaint  incorporates  the  Complaint  of  the  United  States  to  the  extent  any  of  the 
allegations  there  are  relevant  to  Intervenor-Plaintiff  EPIC  and  do  not  conflict  with  the  allegations 
below.  EPIC  adopts  such  allegations  as  its  own. 

The  History  of  EPIC’s  2009  Complaint  &  the  FTC’S  2012  Consent  Order  Against  Facebook 

12.  In  2009,  EPIC  and  others  filed  a  complaint  with  the  FTC  that  alleged  that  Facebook  had 
changed  the  privacy  settings  available  to  users  in  a  way  that  made  personal  information,  such  as 
their  friends  lists,  publicly  available.3  EPIC  further  alleged  that  Facebook  made  personal 
infonnation  available  to  application  developers  without  users’  knowledge  or  consent;  that 
Facebook  Connect  decreased  users’  control  over  disclosure  of  personal  infonnation;  that 
Facebook’s  iPhone  syncing  secretly  disclosed  personal  information;  that  Facebook’s  social 
plugins  revealed  user  information  without  user  consent;  and  that  Facebook  allowed  developers  to 
retain  user  data  indefinitely.4 

13.  Following  the  submission  of  its  complaint,  EPIC  received  a  letter  from  the  Commission 
on  January  14,  2010,  stating  that  “[yjour  most  recent  complaint  raises  issues  of  particular  interest 


3  Complaint,  Request  for  Investigation,  Injunction,  and  Other  Relief  of  EPIC  et  ah,  In  re: 
Facebook,  Inc.  (2009),  https://epic.org/privacy/inrefacebook/EPIC-FacebookComplaint.pdf. 

4  Id. 
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for  us  at  this  time.”5  On  January  14,  2010,  EPIC  and  others  supplemented  the  original  complaint 
and  described  Facebook’s  practices  for  access  to  users’  passwords,  representations  regarding 
Facebook  Connect,  and  representations  regarding  iPhone  syncing  were  unfair  and  deceptive.6  On 
May  5,  2010,  EPIC  filed  a  second  complaint  with  the  Commission  concerning  Facebook’s 
disclosure  of  users’  previously-restricted  personal  information  to  Facebook’s  business  partners 
and  the  general  public.7  The  infonnation  disclosed  by  Facebook  included  employment  history, 
education,  location,  hometown,  film  preferences,  music  preferences,  and  reading  preferences.8 
14.  On  November  29,  2011,  the  FTC  announced  a  proposed  settlement  agreement  with 
Facebook  over  the  company’s  unfair  and  deceptive  business  practices.9  The  FTC  identified  eight 
specific  counts,  including  changes  to  users’  privacy  settings,  application  access  to  user  data, 
advertiser  access  to  use  data,  photo  and  video  deletion,  and  violations  of  the  Safe  Harbor 
Framework.10  According  to  the  FTC,  “under  the  proposed  settlement,  Facebook  is: 

•  barred  from  making  misrepresentations  about  the  privacy  or  security  of 
consumers’  personal  information; 

•  required  to  obtain  consumers’  affirmative  express  consent  before  enacting 
changes  that  override  their  privacy  preferences; 


5  Fetter  from  Director,  FTC  Bureau  of  Consumer  Protection,  to  Marc  Rotenberg,  Director,  EPIC 
(Jan.  14,  2010),  https://epic.org/privacy/inrefacebook/Facebook_Vladeck_Fetter.pdf. 

6  Supplemental  Materials  Submitted  by  EPIC  et  al.  in  Support  of  Pending  Complaint  and 
Request  for  Injunction,  Request  for  Investigation  and  for  Other  Relief,  In  re  Facebook,  Inc.  (Jan. 
14,  2010),  https://epic.org/privacy/inrefacebook/EPIC_Facebook_Supp.pdf. 

7  Complaint,  Request  for  Investigation,  Injunction,  and  Other  Relief,  In  re  Facebook ,  Inc.  (May 
5,  2010),  https://epic.org/privacy/facebook/EPIC_FTC_FB_Complaint.pdf. 

8  hi. 

9  In  re  Facebook,  Inc.,  FTC  File  No.  092  3184  (2011)  (Agreement  Containing  Consent  Order), 
http://www.ftc.gov/os/caselist/0923 184/1 1 1 129facebookagree.pdf. 

10  Id. 
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•  required  to  prevent  anyone  from  accessing  a  user’s  material  more  than  30  days 
after  the  user  has  deleted  his  or  her  account; 

•  required  to  establish  and  maintain  a  comprehensive  privacy  program  designed  to 
address  privacy  risks  associated  with  the  development  and  management  of  new 
and  existing  products  and  services,  and  to  protect  the  privacy  and  confidentiality 
of  consumers’  infonnation;  and 

•  required,  within  180  days,  and  every  two  years  after  that  for  the  next  20  years,  to 
obtain  independent,  third-party  audits  certifying  that  it  has  a  privacy  program  in 
place  that  meets  or  exceeds  the  requirements  of  the  FTC  order,  and  to  ensure  that 
the  privacy  of  consumers'  information  is  protected.”11 

15.  The  Chainnan  of  the  Federal  Trade  Commission  at  the  time,  John  Liebowitz,  stated 
“Facebook  is  obligated  to  keep  the  promises  about  privacy  that  it  makes  to  its  hundreds  of 
millions  of  users.  Facebook’s  innovation  does  not  have  to  come  at  the  expense  of  consumer 
privacy.  The  FTC  action  will  ensure  it  will  not.”12 

16.  The  Commission  made  clear  EPIC’s  role  in  the  establishment  of  the  Consent  Order, 
which  is  the  legal  basis  of  the  proposed  Consent  Decree  now  before  this  Court.  In  announcing 
the  proposed  Consent  Order,  the  Commission  stated  that  “Facebook’s  privacy  practices  were  the 
subject  of  complaints  filed  with  the  FTC  by  the  Electronic  Privacy  Information  Center  and  a 
coalition  of  consumer  groups.”13 


11  Press  Release,  Fed.  Trade  Comrn’n,  Facebook  Settles  FTC  Charges  that  It  Deceived 
Consumers  by  Failing  to  Keep  Privacy  Promises  (Nov.  29,  2011), 
http://www.ftc.gov/opa/201 1/1 1/privacysettlement.shtm. 

12  Id. 

13  Id. 
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The  Subsequent  History  of  EPIC’s  Complaints  Filed  With  the  FTC  Against  Facebook  After  the 
2012  Consent  Order 

17.  Since  2012,  EPIC  has  filed  five  detailed  complaints  with  the  Commission  regarding 
Facebook’s  business  practices,  alleging  violations  of  the  Consent  Order.  All  of  these  complaints, 
as  well  as  many  similar  complaints  brought  to  the  Commission  by  consumer  and  privacy 
organizations  representing  the  interests  of  Facebook  users,  would  be  extinguished  by  the 
proposed  consent  decree  that  the  FTC  and  Facebook  have  submitted. 

18.  In  2014,  EPIC  submitted  a  complaint  to  the  FTC  concerning  Facebook's  manipulation  of 
users’  News  Feeds  for  psychological  research.14  EPIC  argued  that  Facebook  had  “altered  the 
News  Feeds  of  Facebook  users  to  elicit  positive  and  negative  emotional  responses.”15  EPIC 
further  alleged  that  the  researchers  “failed  to  follow  standard  ethical  protocols  for  human  subject 
research”  and  that  Facebook  violated  Section  5  of  the  FTC  Act  when  it  did  not  get  users’ 
permission  to  conduct  this  study  or  notify  users  that  their  data  would  be  disclosed  to 
researchers.16  These  allegations  have  not  been  addressed  by  the  FTC. 

19.  Also  in  2014,  Facebook  acquired  the  private  messaging  application  WhatsApp  and  EPIC, 
along  with  the  Center  for  Digital  Democracy,  filed  a  complaint  urging  the  Commission  to  block 
the  acquisition.17  In  2016,  after  the  merger  had  been  approved,  WhatsApp  announced  its  plans  to 
transfer  users’  personal  infonnation  to  Facebook,  including  their  phone  numbers,  for  Facebook 
to  use  for  targeted  advertising.18  EPIC  and  CDD  filed  a  complaint  with  the  FTC  opposing  the 


14  Complaint,  In  re  Facebook,  Inc.  (July  3,  2014)  [hereinafter  EPIC  2014  Facebook  Complaint], 
https://epic.org/privacy/internet/ftc/facebook/psycho/Facebook-Study-Complaint.pdf. 

15  Id.  at  1. 

16  Id. 

17  Complaint,  In  re  WhatsApp,  Inc.  (Mar.  6,  2014)  [hereinafter  EPIC  2014  WhatsApp 
Complaint],  https://epic.org/privacy/ftc/whatsapp/WhatsApp-Complaint.pdf. 

18  Looking  Ahead  for  WhatsApp,  WhatsApp  Blog  (Aug.  25,  2016), 
https://blog.whatsapp.com/10000627/Looking-ahead-for-WhatsApp. 
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transfer  of  WhatsApp  use  data  to  Facebook  and  arguing  that  the  proposed  policy  changes 
violated  Section  5  of  the  FTC  Act.19  These  allegations  have  not  been  addressed  by  the  FTC. 

20.  In  2018,  EPIC  and  a  coalition  of  consumer  privacy  organizations  filed  a  complaint  with 
the  Federal  Trade  Commission  charging  that  Facebook's  facial  recognition  practice  lacked 
privacy  safeguards  and  violated  the  2012  Consent  Order  with  the  Commission.20  As  EPIC 
explained  in  its  complaint,  in  early  2018,  Facebook  began  routinely  scanning  photos,  posted  by 
users,  for  biometric  facial  matches  without  the  consent  of  either  the  image  subject  or  the  person 
who  uploaded  the  photo.21  EPIC  and  consumer  groups  requested  that  “the  Commission 
investigate  Facebook,  enjoin  the  deployment  of  additional  facial  recognition  techniques  as  a 
violation  of  the  2012  Consent  Order,  and  require  Facebook  to  modify  its  biometric  data  practices 
to  protect  the  privacy  of  Facebook  users  and  non-users.”22  These  allegations  have  not  been 
addressed. 

2 1 .  Perhaps  most  significantly  in  20 1 8,  EPIC  along  with  sixteen  consumer  organizations 
wrote  the  FTC  a  letter  urging  the  Commission  to  investigate  the  unprecedented  disclosure  of 
personal  data  uncovered  in  the  Facebook  Cambridge  Analytica  scandal.  The  organizations  wrote: 
“On  behalf  of  leading  consumer  privacy  organizations  in  the  United  States,  we  urge  you  to 
immediately  investigate  whether  Facebook’s  alleged  disclosure  of  the  personal  data  of  50  million 
Americans  to  the  data  mining  firm  Cambridge  Analytica  violated  the  FTC  Consent  Order  with 


19  Complaint,  In  re  WhatsApp ,  Inc.  (Aug  29,  2016)  [hereinafter  EPIC  2016  WhatsApp 
Complaint],  https://epic.org/privacy/ftc/whatsapp/EPIC-CDD-FTC-WhatsApp-Complaint- 
2016.pdf. 

20  Complaint,  In  re  Facebook,  Inc.  and  Facial  Recognition  (Apr.  6,  2018)  [hereinafter  EPIC 
2018  Facebook  Complaint],  https://epic.org/privacy/facebook/FTC-Facebook-FR-Complaint- 
04062018.pdf. 

21  Id. 

22  Id.  at  38. 
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Facebook  we  helped  obtain.”23  One  week  later,  the  FTC  announced  it  would  reopen  the 
investigation  of  Facebook.24 

22.  These  actions  and  complaints  pursued  by  EPIC  and  others  on  behalf  of  Facebook  users 
are  directly  relevant  to  the  Court’s  consideration  of  the  FTC’s  proposed  Consent  Decree  with 
Facebook. 

23.  Even  the  actions  of  EPIC  and  the  associated  organizations  do  not  describe  the  full  range 
of  public  interest  in  this  matter.  More  than  26,000  consumer  complaints  about  Facebook  are 
currently  pending  at  the  Commission,  and  the  number  of  complaints  against  the  company  has 
been  doubling  annually.25  In  2018  alone,  the  FTC  received  8,391  consumer  complaints  about 
Facebook,  nearly  twice  the  number  received  in  2016  (4,612),  and  more  than  four  times  the 
number  received  in  2014  (1,860)  26 

The  FTC’s  Proposed  Consent  Decree  with  Facebook 

24.  The  FTC’s  proposed  Consent  Decree  with  Facebook  is  both  the  most  significant  and 
most  controversial  decree  in  the  history  of  the  Commission.  The  proposed  Consent  Decree 


23  Letter  from  EPIC  et  al.  to  Maureen  Ohlhausen,  Acting  Chairman,  FTC,  and  Terrell 
McSweeney,  Commissioner,  FTC  (Mar.  20,  2018),  https://epic.org/privacy/facebook/EPIC-et-al- 
ltr-FTC-Cambridge-FB-03-20-18.pdf.  The  organizations  that  signed  the  March  20,  2018  to  the 
Commission  were:  the  Electronic  Privacy  Information  Center,  Access  Now,  Campaign  for 
Commercial  Free  Childhood,  Center  for  Digital  Democracy,  Constitutional  Alliance,  Consumer 
Action,  Consumer  Federation  of  America,  Consumer  Watchdog,  Cyber  Privacy  Project, 
Defending  Rights  &  Dissent,  Government  Accountability  Project,  Patient  Privacy  Rights, 
Privacy  Rights  Clearinghouse,  Privacy  Times,  Public  Citizen,  U.S.  PIRG,  and  the  World 
Privacy  Forum. 

24  Press  Release,  Fed.  Trade  Comm’n,  Statement  by  the  Acting  Director  of  FTC ’s  Bureau  of 
Consumer  Protection  Regarding  Reported  Concerns  About  Facebook  Privacy  Practices  (Mar. 
26,  20 1 8),  https://www.ftc.gov/news-events/press-releases/20 1 8/03/statement-acting-director- 
ftcs-bureau-consumer-protection. 

25  FOIA  Request  from  EPIC  to  FTC  (Mar.  13,  2019)  [hereinafter  EPIC  2019  FOIA  Request], 
https://epic.org/foia/ftc/facebook/EPIC-19-03-13-FTC-FOIA-20190313-Request.pdf. 

26  FTC  Response  to  EPIC  FOIA  Request  (Apr.  2,  2019),  https://epic.org/foia/ftc/facebook/EPIC- 
19-03-13-FTC-FOIA-20190402-Complaint-Number-Breakdown.pdf. 
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concerns  the  business  practices  of  the  world’s  largest  social  media  company,  the  privacy  interests 
of  hundreds  of  millions  of  Americans,  and  more  than  2.3  billion  people  around  the  globe.  The 
decree  also  directly  impacts  the  interests  of  EPIC  and  other  groups,  who  have  worked  diligently 
to  safeguard  the  interests  of  Facebook  uses  and  who  have  submitted  comprehensive  complaints 
to  the  FTC  concerning  violations  of  the  2012  Consent  Order. 

25.  The  proposed  decree  states  that  “[t]he  parties  have  consented  to  entry  of  this  Stipulated 
Order  to  resolve  any  and  all  claims  that  Defendant,  its  officers,  and  directors,  prior  to  June  12, 
2019,  violated  the  Commission’s  Decision  and  Order  in  In  re  Facebook,  Inc.,  C-4365,  2012  FTC 
FEXIS  135  (F.T.C.  July  27,  2012).  Furthermore,  this  Consent  Decree  resolves  all  consumer- 
protection  claims  known  by  the  FTC  prior  to  June  12,  2019,  that  Defendant,  its  officers,  and 
directors  violated  Section  5  of  the  FTC  Act.”27 

26.  Commissioner  Rohit  Chopra  and  Commissioner  Rebecca  Slaughter  both  dissented  from 
the  FTC’s  approval  of  the  Consent  Decree,  highlighting  that  the  decree  immunizes  the  firm  for 
undisclosed  violations.  Commissioner  Chopra  said:  “This  shield  represents  a  major  win  for 
Facebook,  but  leaves  the  public  in  the  dark  as  to  how  the  company  violated  the  law,  and  what 
violations  if  any  are  going  unaddressed.”28  Commissioner  Slaughter  said:  “I  am  concerned  that  a 
release  of  this  scope  is  unjustified  by  our  investigation  and  unsupported  by  either  precedent  or 


27  Stipulated  Order  for  Civil  Penalty,  Monetary  Judgement,  and  Injunctive  Relief,  United  States 
v.  Facebook,  No.  19-cv-2184  at  1-2  (D.D.C.  July  24,  2019),  ECFNo.  2-1. 

28  Dissenting  Statement  of  Commissioner  Rohit  Chopra,  In  re  Facebook,  Inc.,  Commission  File 
No.  1823109  at  17  (July  24,  2019), 

https://www.ftc .  gov/ system/  files/ documents/public_statements/ 1536911/  chopra_dissenting_ 
statement_on_facebook_7-24- 1 9.pdf. 
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sound  public  policy.  To  the  contrary,  in  every  recent  major  federal  settlement,  if  there  was  a 
liability  release,  it  was  cabined  to  the  offenses  described  in  the  complaint.”29 

27.  Members  of  Congress  have  been  outspoken  in  their  opposition  to  the  settlement.  Senator 
Markey  (D-MA)  said:  “With  its  settlement  with  Facebook,  the  FTC  not  only  fell  short,  it  fell  on 
its  face.  Facebook  is  getting  away  with  some  of  the  most  egregious  corporate  bad  behavior  in  the 
age  of  the  internet.”30  Senator  Hawley  (D-MO)  said:  “This  is  very  disappointing.  This  settlement 
does  nothing  to  change  Facebook’s  creepy  surveillance  of  its  own  users  &  the  misuse  of  user 
data.  It  does  nothing  to  hold  executives  accountable.  It  utterly  fails  to  penalize  Facebook  in  any 
effective  way.”31  The  New  York  Times  Editorial  Board  also  spoke  out  against  the  settlement.32 

28.  The  FTC  did  not  “place  the  order  contained  in  the  consent  agreement,  the  complaint,  and 
the  consent  agreement  on  the  public  record  for  a  period  of  30  days,  or  such  other  period  as  the 
Commission  may  specify,  for  the  receipt  of  comments  or  views  from  any  interested  person,”  as 
required  by  16  C.F.R.  §  2.34(c). 

Effect  of  Liability  Waiver  on  EPIC 

29.  The  liability  waiver  contained  in  the  Stipulated  Order  resolves  all  complaints  submitted 
prior  to  June  12,  2019,  alleging  that  Facebook,  its  officers,  and  its  directors  violated  Section  5  of 


29  Dissenting  Statement  of  Commissioner  Rebecca  Slaughter,  In  re  Facebook,  Inc.,  Commission 
File  No.  1823109  at  14  (July  24,  2019), 

https://www.ftc .  gov/ system/  files/ documents/public_statements/ 1536918/1 82_3 1 09_slaughter_ 
statement_on_facebook_7-24- 1 9.pdf. 

30  Ed  Markey,  Senator  Markey  Blasts  FTC  Facebook  Privacy  Settlement  (July  24,  2019), 
https://www.markey.senate.gov/news/press-releases/senator-markey-blasts-ftc-facebook- 
privacy-settlement. 

31  Josh  Hawley  (@HawleyMO),  Twitter  (July  24,  2019,  10:36  AM), 
https://twitter.eom/HawleyMO/status/l  154037744290557952. 

32  Editorial  Board,  A  $5  Billion  Fine  for  Facebook  Won ’t  Fix  Privacy,  N.Y.  Times  (July  25, 
2019),  https://www.nytimes.com/2019/07/25/opinion/facebook-fine-5-billion.html. 
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the  FTC  Act,  including  the  five  complaints  EPIC  submitted  to  the  FTC  concerning  Facebook 
between  2014-2018,  and  thus  prevents  the  FTC  from  pursuing  these  claims  in  the  future. 

30.  The  FTC’s  proposed  settlement  with  Facebook  does  not  address  all  of  the  claims 
contained  in  the  complaints  filed  prior  to  June  12,  2019,  including  much  of  the  claims  alleged  in 
EPIC’s  five  complaints. 

3 1 .  The  liability  waiver  would  prevent  EPIC  from  seeking  relief  from  the  FTC  through  the 
administrative  complaint  process  for  the  violations  detailed  in  the  prior  complaints. 

32.  Because  EPIC  would  be  prevented  from  seeking  relief  through  the  FTC,  EPIC  will  have 
to  redirect  resources  toward  researching  and  pursuing  alternative  means  of  addressing 
Facebook’s  privacy  violations,  including  researching  state  consumer  protection  laws  and 
pursuing  complaints  at  the  state  level. 

33.  If  the  FTC  did  not  grant  Facebook  an  overly  broad  liability  waiver,  EPIC  would  not  have 
to  pursue  alternative  means  to  hold  Facebook  accountable  for  privacy  violations  contained  in 
complaints  prior  to  June  12,  2019. 

Effect  of  Failure  to  Submit  Settlement  for  Public  Comment  on  EPIC 

34.  EPIC  routinely  submits  comments  to  the  FTC  on  proposed  settlements. 

35.  Because  the  FTC  can  modify  or  withdraw  the  agreement  in  response  to  comments 
received,  16  C.F.R.  §  2.34(e),  the  Commission’s  decision  not  to  accept  comments  on  the 
proposed  agreement  deprives  EPIC  of  an  opportunity  to  influence  the  FTC’s  decision  making  on 
the  proposed  settlement. 

36.  In  response  to  this  deprivation,  EPIC  has  pursued  this  motion  to  intervene  as  an 
alternative  avenue  to  be  heard  on  the  proposed  settlement,  which  would  not  have  been  necessary 
had  the  FTC  solicited  public  comment  on  the  settlement  under  16  C.F.R.  §  2.34(c). 
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37.  An  order  directing  the  FTC  to  open  the  proposed  settlement  to  public  comment  would 
redress  EPIC’s  injury  by  providing  an  opportunity  to  comment. 

Count  I 

Violation  of  the  APA:  Unlawful  Agency  Action 

38.  Intervenor-Plaintiff  asserts  and  incorporates  by  reference  paragraphs  1-37. 

39.  Intervenor-Defendants’  failure  to  address  all  claims  that  form  the  basis  of  the  liability 
waiver  constitutes  conduct  that  is  arbitrary,  capricious,  an  abuse  of  discretion,  or  otherwise  not  in 
accordance  with  law  under  5  U.S.C.  §  706(2)(A). 

40.  Intervenor-Defendant’s  conduct  constitutes  final  agency  action  subject  to  judicial  review 
under  5  U.S.C.  §  704. 

41.  Intervenor-Plaintiff  is  adversely  affected,  aggrieved,  and  injured  in  fact  by  Intervenor- 
Defendants’  violation  of  5  U.S.C.  §  706(2)(A).  By  granting  Facebook  immunity  for  all 
complaints  filed  with  the  Commission  between  2012  and  2019,  the  FTC  deprives  EPIC  of  the 
ability  to  seek  redress  for  such  claims  through  any  future  administrative  complaint.  In  response, 
EPIC  must  expend  resources  to  research  and  pursue  alternative  means  of  enforcement. 

42.  Intervenor-Plaintiff  has  exhausted  all  applicable  administrative  remedies. 

Count  II 

Violation  of  the  APA:  Unlawful  Agency  Action 

43.  Intervenor-Plaintiff  asserts  and  incorporates  by  reference  paragraphs  1-37. 

44.  Intervenor-Defendant  failed  to  “place  the  order  contained  in  the  consent  agreement,  the 
complaint,  and  the  consent  agreement  on  the  public  record  for  a  period  of  30  days,  or  such  other 
period  as  the  Commission  may  specify,  for  the  receipt  of  comments  or  views  from  any  interested 
person,”  in  violation  of  16  C.F.R.  §  2.34(c). 
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45.  By  failing  to  accept  public  comments  on  the  proposed  settlement,  Intervenor-Defendant 
has  engaged  in  conduct  that  is  arbitrary,  capricious,  an  abuse  of  discretion,  or  otherwise  not  in 
accordance  with  law  under  5  U.S.C.  §  706(2)(A)  and  without  observance  of  procedure  required 
by  law  under  5  U.S.C.  §  706(2)(D). 

46.  Intervenor-Defendants’  conduct  constitutes  final  agency  action  under  5  U.S.C.  §  704. 

47.  Intervenor-Plaintiff  is  adversely  affected,  aggrieved,  and  injured  in  fact  by  Intervenor- 
Defendants’  actions.  By  failing  to  accept  public  comment  on  the  proposed  settlement,  the  FTC 
deprives  EPIC  of  an  opportunity  to  comment.  In  response,  EPIC  has  expended  resources  to 
pursue  alternative  means  of  voicing  its  concerns  about  the  settlement,  including  this  Action. 

48.  Intervenor-Plaintiff  has  exhausted  all  applicable  administrative  remedies. 

Count  III 

Claim  for  Declaratory  Relief  Under  28  U.S.C.  §  2201(a) 

49.  Intervenor-Plaintiff  asserts  and  incorporates  by  reference  paragraphs  1-37. 

50.  Intervenor-Plaintiff  is  entitled  under  28  U.S.C.  §  2201(a)  to  a  declaration  of  the  rights  and 
other  legal  relations  of  the  parties  with  respect  to  the  claims  set  forth  in  Counts  I — II. 

Requested  Relief 

WHEREFORE,  Intervenor-Plaintiff  requests  that  this  Court: 

A.  Not  to  enter  the  Stipulated  Order; 

B.  Enjoin  Intervenor-Defendant  from  entering  into  a  consent  decree  with  Facebook  that 
includes  a  liability  waiver  for  claims  not  addressed  in  the  complaint  or  the  agreement 
absent  a  reasoned  explanation  for  each  claim; 

C.  Order  Intervenor-Defendant  to  place  the  order  contained  in  the  consent  agreement,  the 
complaint,  and  the  consent  agreement  on  the  public  record  for  a  period  of  30  days,  or 
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such  other  period  as  the  Commission  may  specify,  for  the  receipt  of  comments  or  views 
from  any  interested  person; 

D.  Award  EPIC  costs  and  reasonable  attorney’s  fees  incurred  in  this  action;  and 

E.  Grant  such  other  relief  as  the  Court  may  deem  just  and  proper. 


Respectfully  Submitted, 

MARC  ROTENBERG,  D.C.  Bar  #422825 
EPIC  President  and  Executive  Director 

/s/  Alan  Butler _ 

ALAN  BUTLER,  D.C.  Bar  #1012128 
EPIC  Senior  Counsel 

MEGAN  IORIO,  D.C.  Bar  #1618365 
EPIC  Appellate  Advocacy  Counsel 

ELECTRONIC  PRIVACY 
INFORMATION  CENTER 
1519  New  Hampshire  Avenue,  N.W. 
Washington,  D.C.  20036 
(202)  483-1140  (telephone) 

(202)  483-1248  (facsimile) 

Attorneys  for  Intervenor-Plaintiff  EPIC 


Dated:  August  12,  2019 
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